Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/c/negative.c

@@ -0,0 +1,24 @@
+/* Negative fixture: none of these should trigger security patterns. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+void safe_snprintf(const char *name) {
+    char buf[128];
+    snprintf(buf, sizeof(buf), "Hello %s", name);
+}
+
+void safe_strncpy(const char *src) {
+    char dst[32];
+    strncpy(dst, src, sizeof(dst) - 1);
+    dst[sizeof(dst) - 1] = '\0';
+}
+
+void safe_fgets() {
+    char buf[64];
+    fgets(buf, sizeof(buf), stdin);
+}
+
+void safe_printf_literal() {
+    printf("Hello %s\n", "world");
+}

tests/fixtures/patterns/c/positive.c

@@ -0,0 +1,50 @@
+/* Positive fixture: each snippet should trigger the named pattern. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* c.memory.gets */
+void trigger_gets() {
+    char buf[64];
+    gets(buf);
+}
+
+/* c.memory.strcpy */
+void trigger_strcpy(char *src) {
+    char dst[32];
+    strcpy(dst, src);
+}
+
+/* c.memory.strcat */
+void trigger_strcat(char *extra) {
+    char buf[64] = "prefix";
+    strcat(buf, extra);
+}
+
+/* c.memory.sprintf */
+void trigger_sprintf(const char *name) {
+    char buf[128];
+    sprintf(buf, "Hello %s", name);
+}
+
+/* c.memory.scanf_percent_s */
+void trigger_scanf() {
+    char name[32];
+    scanf("%s", name);
+}
+
+/* c.cmdi.system */
+void trigger_system(const char *cmd) {
+    system(cmd);
+}
+
+/* c.cmdi.popen */
+void trigger_popen(const char *cmd) {
+    FILE *f = popen(cmd, "r");
+    pclose(f);
+}
+
+/* c.memory.printf_no_fmt */
+void trigger_printf_no_fmt(char *user_data) {
+    printf(user_data);
+}